{"update": {"autokarma": true, "autotime": false, "stable_karma": 3, "stable_days": 0, "unstable_karma": -3, "require_bugs": true, "require_testcases": true, "display_name": "", "notes": "## 2.4.10 (2016-05-09)\n\n- Fix HeaderValue throwing an exception on legal characters\n\n## 2.4.9 (2015-11-23)\n\n### SECURITY UPDATES\n\n- **ZF2015-09**: `Zend\\Captcha\\Word` generates a \"word\" for a CAPTCHA challenge\n  by selecting a sequence of random letters from a character set. Prior to this\n  vulnerability announcement, the selection was performed using PHP's internal\n  `array_rand()` function. This function does not generate sufficient entropy\n  due to its usage of `rand()` instead of more cryptographically secure methods\n  such as `openssl_pseudo_random_bytes()`. This could potentially lead to\n  information disclosure should an attacker be able to brute force the random\n  number generation. This release contains a patch that replaces the\n  `array_rand()` calls to use `Zend\\Math\\Rand::getInteger()`, which provides\n  better RNG.\n- **ZF2015-10**: `Zend\\Crypt\\PublicKey\\Rsa\\PublicKey` has a call to `openssl_public_encrypt()`\n  which used PHP's default `$padding` argument, which specifies\n  `OPENSSL_PKCS1_PADDING`, indicating usage of PKCS1v1.5 padding. This padding\n  has a known vulnerability, the\n  [Bleichenbacher's chosen-ciphertext attack](http://crypto.stackexchange.com/questions/12688/can-you-explain-bleichenbachers-cca-attack-on-pkcs1-v1-5),\n  which can be used to recover an RSA private key. This release contains a patch\n  that changes the padding argument to use `OPENSSL_PKCS1_OAEP_PADDING`.\n\n  Users upgrading to this version may have issues decrypting previously stored\n  values, due to the change in padding. If this occurs, you can pass the\n  constant `OPENSSL_PKCS1_PADDING` to a new `$padding` argument in\n  `Zend\\Crypt\\PublicKey\\Rsa::encrypt()` and `decrypt()` (though typically this\n  should only apply to the latter):\n\n  ```php\n  $decrypted = $rsa->decrypt($data, $key, $mode, OPENSSL_PKCS1_PADDING);\n  ```\n\n  where `$rsa` is an instance of `Zend\\Crypt\\PublicKey\\Rsa`.\n\n  (The `$key` and `$mode` argument defaults are `null` and\n  `Zend\\Crypt\\PublicKey\\Rsa::MODE_AUTO`, if you were not using them previously.)\n\n  We recommend re-encrypting any such values using the new defaults.", "type": "security", "status": "stable", "request": null, "severity": "unspecified", "suggest": "unspecified", "locked": false, "pushed": true, "critpath": false, "critpath_groups": null, "close_bugs": true, "date_submitted": "2016-06-12 05:26:21", "date_modified": null, "date_approved": null, "date_testing": "2016-06-12 22:55:43", "date_stable": "2016-06-21 18:29:37", "alias": "FEDORA-2016-03c0ed3127", "test_gating_status": null, "from_tag": null, "date_pushed": "2016-06-21 18:29:37", "meets_testing_requirements": false, "url": "https://bodhi.stg.fedoraproject.org/updates/FEDORA-2016-03c0ed3127", "title": "php-ZendFramework2-2.4.10-1.fc22 php-zendframework-zendxml-1.0.2-2.fc22", "version_hash": "72241326f2b05e7b76f711a125a6ababcfc12dd8", "release": {"name": "F22", "long_name": "Fedora 22", "version": "22", "id_prefix": "FEDORA", "branch": "f22", "dist_tag": "f22", "stable_tag": "f22-updates", "testing_tag": "f22-updates-testing", "candidate_tag": "f22-updates-candidate", "pending_signing_tag": "", "pending_testing_tag": "f22-updates-testing-pending", "pending_stable_tag": "f22-updates-pending", "override_tag": "f22-override", "mail_template": "fedora_errata_template", "state": "archived", "composed_by_bodhi": true, "create_automatic_updates": null, "package_manager": "dnf", "testing_repository": "updates-testing", "released_on": null, "eol": null, "critpath_mandatory_days_in_testing": 14, "mandatory_days_in_testing": 7, "critpath_min_karma": 2, "min_karma": 1, "setting_status": null}, "user": {"name": "siwinski", "email": "shawn@iwin.ski", "id": 130, "avatar": "https://seccdn.libravatar.org/avatar/d42670db55f2a02bd45bb03a22919c9013b73f6ae62d6c1a9a2eab3afefa3334?s=24&d=retro", "openid": "siwinski.id.stg.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}, "comments": [{"karma": 0, "karma_critpath": 0, "text": "This update has been submitted for testing by siwinski. ", "timestamp": "2016-06-12 05:26:21", "update_id": 60322, "user_id": 91, "id": 445482, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.stg.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been pushed to testing.", "timestamp": "2016-06-12 23:55:06", "update_id": 60322, "user_id": 91, "id": 445739, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.stg.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has reached 7 days in testing and can be pushed to stable now if the maintainer wishes", "timestamp": "2016-06-20 00:00:29", "update_id": 60322, "user_id": 91, "id": 448745, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.stg.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been submitted for stable by siwinski. ", "timestamp": "2016-06-21 00:19:02", "update_id": 60322, "user_id": 91, "id": 449086, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.stg.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been pushed to stable.", "timestamp": "2016-06-22 01:23:38", "update_id": 60322, "user_id": 91, "id": 449448, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.stg.fedoraproject.org", "groups": []}}], "builds": [{"nvr": "php-ZendFramework2-2.4.10-1.fc22", "signed": true, "release_id": 12, "type": "rpm", "epoch": 0}, {"nvr": "php-zendframework-zendxml-1.0.2-2.fc22", "signed": true, "release_id": 12, "type": "rpm", "epoch": 0}], "bugs": [{"bug_id": 1289317, "title": "CVE-2015-7503 php-ZendFramework2: Usage of vulnerable PKCS#1 v1.5 padding allows to recover RSA private key [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1289318, "title": "CVE-2015-7503 php-ZendFramework2: Usage of vulnerable PKCS#1 v1.5 padding allows to recover RSA private key [epel-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1343990, "title": "[epel7][security] php-ZendFramework2-2.4.10 is available", "security": false, "parent": false, "feedback": []}, {"bug_id": 1343995, "title": "[f23][f22][security] php-ZendFramework2-2.4.10 is available", "security": false, "parent": false, "feedback": []}], "updateid": "FEDORA-2016-03c0ed3127", "karma": 0, "content_type": "rpm", "test_cases": []}, "can_edit": false, "ci_allowed": false}